OpenE2K
/
glibc
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

prune_impossible_nodes: Avoid overflow in computing re_malloc buffer size

This commit is contained in:
Paul Eggert 2010-01-22 12:03:56 -08:00 committed by Ulrich Drepper
parent daa8454919
commit 4cd028677b
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,5 +1,9 @@
2010-01-22 Jim Meyering <jim@meyering.net>
[BZ #11189]
* posix/regexec.c (prune_impossible_nodes): Avoid overflow
in computing re_malloc buffer size.
[BZ #11188]
* posix/regexec.c (build_trtable): Avoid arithmetic overflow
in size calculation.

5
posix/regexec.c
View File

@ -949,6 +949,11 @@ prune_impossible_nodes (mctx)
#endif
match_last = mctx->match_last;
halt_node = mctx->last_node;
/* Avoid overflow. */
if (BE (SIZE_MAX / sizeof (re_dfastate_t *) <= match_last, 0))
return REG_ESPACE;
sifted_states = re_malloc (re_dfastate_t *, match_last + 1);
if (BE (sifted_states == NULL, 0))
{